Analysis
-
max time kernel
72s -
max time network
76s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system -
submitted
20/11/2023, 16:26
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.thestreameast.to/ccce-nhl-streams
Resource
win10-20231020-en
General
-
Target
https://www.thestreameast.to/ccce-nhl-streams
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133449712063311647" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1440 chrome.exe 1440 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe Token: SeShutdownPrivilege 1440 chrome.exe Token: SeCreatePagefilePrivilege 1440 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe 1440 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1440 wrote to memory of 1444 1440 chrome.exe 71 PID 1440 wrote to memory of 1444 1440 chrome.exe 71 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 1460 1440 chrome.exe 74 PID 1440 wrote to memory of 4572 1440 chrome.exe 73 PID 1440 wrote to memory of 4572 1440 chrome.exe 73 PID 1440 wrote to memory of 636 1440 chrome.exe 75 PID 1440 wrote to memory of 636 1440 chrome.exe 75 PID 1440 wrote to memory of 636 1440 chrome.exe 75 PID 1440 wrote to memory of 636 1440 chrome.exe 75 PID 1440 wrote to memory of 636 1440 chrome.exe 75 PID 1440 wrote to memory of 636 1440 chrome.exe 75 PID 1440 wrote to memory of 636 1440 chrome.exe 75 PID 1440 wrote to memory of 636 1440 chrome.exe 75 PID 1440 wrote to memory of 636 1440 chrome.exe 75 PID 1440 wrote to memory of 636 1440 chrome.exe 75 PID 1440 wrote to memory of 636 1440 chrome.exe 75 PID 1440 wrote to memory of 636 1440 chrome.exe 75 PID 1440 wrote to memory of 636 1440 chrome.exe 75 PID 1440 wrote to memory of 636 1440 chrome.exe 75 PID 1440 wrote to memory of 636 1440 chrome.exe 75 PID 1440 wrote to memory of 636 1440 chrome.exe 75 PID 1440 wrote to memory of 636 1440 chrome.exe 75 PID 1440 wrote to memory of 636 1440 chrome.exe 75 PID 1440 wrote to memory of 636 1440 chrome.exe 75 PID 1440 wrote to memory of 636 1440 chrome.exe 75 PID 1440 wrote to memory of 636 1440 chrome.exe 75 PID 1440 wrote to memory of 636 1440 chrome.exe 75
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.thestreameast.to/ccce-nhl-streams1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff8d8c09758,0x7ff8d8c09768,0x7ff8d8c097782⤵PID:1444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1816 --field-trial-handle=1772,i,5748224096249029168,14044684384124783144,131072 /prefetch:82⤵PID:4572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1772,i,5748224096249029168,14044684384124783144,131072 /prefetch:22⤵PID:1460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2092 --field-trial-handle=1772,i,5748224096249029168,14044684384124783144,131072 /prefetch:82⤵PID:636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1772,i,5748224096249029168,14044684384124783144,131072 /prefetch:12⤵PID:1836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2976 --field-trial-handle=1772,i,5748224096249029168,14044684384124783144,131072 /prefetch:12⤵PID:4636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 --field-trial-handle=1772,i,5748224096249029168,14044684384124783144,131072 /prefetch:82⤵PID:164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 --field-trial-handle=1772,i,5748224096249029168,14044684384124783144,131072 /prefetch:82⤵PID:1664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3556 --field-trial-handle=1772,i,5748224096249029168,14044684384124783144,131072 /prefetch:12⤵PID:1260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1484 --field-trial-handle=1772,i,5748224096249029168,14044684384124783144,131072 /prefetch:12⤵PID:1752
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4040
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
432B
MD50bcf49b814a7db3e09146b533d1cdd50
SHA195b4e0d5872bb198e9efa2939edda12ccd35d899
SHA25611fa3d50c512fdbd56ade511ddb45f8c98928af04731645c79fb53e09c7a33f2
SHA51299013b02e69fc6a65479c5bc3589e0df3053d4b58755036a0438e648fed9fde3c31be6c46ccdb4b2b5aa0c9770d679b5e13ff5f59a22fbcec2a02abae6656074
-
Filesize
4KB
MD58ede0b7010bc78fe9abc16f4f434bc26
SHA109dc6cd4ed443d52cb225e0776b0aaaf90489d1d
SHA256f938e250844c3f14caf1ef89f9dda00bab4dc49e1be146df56d0ca5f1e8cc989
SHA5123f18b681c7681ff5633450f7e648070ff6b2bcf3c1e5d3676e44a67affffb4065cc81bb33d15a0337ac25fe9c9c2a1b009b2e4da458945437c279202f4bbe802
-
Filesize
1KB
MD5234ae5258e03b94f1358423e61ecb570
SHA1f8255fe8d09dc559557cfc5ebf140a9814e305f7
SHA256676555a2252220f10901badc8ef7db7a4a8601f071be6fd58f3ab37264393848
SHA512d54e259ec8d8bdf637612c0e5a2341b4ef42e9ec97150abb826fdb68d51e892830521501ed3d66215c72c7c9175a75009227e549caddcb31c1eedccf11144251
-
Filesize
1KB
MD5cde773a9d2977ba43951225e3af196df
SHA13b3a4a52a2b43a8aea4b1acae5c20dce319d924c
SHA256e2180cc311a3069996581ca222dccea0c045e38631dec9c5cc6054c2cf21e782
SHA512d80f259f5ef233c83b806ee9beddc05ace919246034dec006f2224bd90487b770bd48512e125fa123bb828615b0e5780c761352bedf3b72ab674fbe515dc6dca
-
Filesize
6KB
MD5b28fe690727a48f1436178a941bc1e31
SHA147d94e32100ffdb88645cbde848a518339b82420
SHA256b040a981272d4548aa8ae401a061cd2b011ac970e6822072cc3f435543bb46bb
SHA5129bf7cbbd0777a0a26027ae1d8a33348dae314b628299dd8cddf7199a960d58d2b05d2a196075581220846e29abfb97befd18c191b01478c9c89d01ab0be317b2
-
Filesize
6KB
MD57f042cdacaa63cfeeb4bfff030f39ea0
SHA14a34910ce7ee6a740bf56e158379a3dd10ef3746
SHA2565c5fd8b3bbac7651144a682864b95821efef8e8cc039a6054e584d2f4e874740
SHA5123aa2fb6162c7cabb95024cb3b472eab9ec7b1f964a48c4bcc1a57ddce3080b978ce0decd5e94f0e1360a69ebc72d08cfbb8f38a5fe8cf9b1f2f0329cbfc86ec7
-
Filesize
6KB
MD5cc0232396332a32e9ee0f977649bf9c1
SHA1c8025fc61e0dcffe96733fcc75f1f36fb41d4878
SHA2565ab025fcc1b3092c4e4afa70b70000f8b9e8abee7f0a59e87978b890660e74d5
SHA51248baff03cdf58fb36f4764371ac1e5e08fc01720e37c09e4ececc5de560bae7ead6d8a86bb26c69736012bfa6749d7b8b0535b22076f7a9f40184281a9ef2d36
-
Filesize
6KB
MD54f02aef72014448153ab45073a70d403
SHA1cad4b068b0859d885c8f8f091a9fc8d057a070d1
SHA25639675d4d2f389152eae85ce051c59848777796d090e92260a9140dc411f8f541
SHA512236474f1f76ce042dc84c9d2226b9171cd6160829cc792a4d5f89839ea6f6594e50f3d14a3eecc46366bcf48868565162382499f1f468686a2a3cc0cba22dde7
-
Filesize
106KB
MD565d8d43c1111fce717ace85d0364c53c
SHA1e85df8292bbf5e510650e28e0fae485f2484c433
SHA256c8f486de7c7173ae4eda929de9c697998e767095a90e5c4d2a1c339aba644125
SHA5125da1e004f13620ef46fcc9c1b78d4ebb269a7bd08dffc6a6e65d0bd8e7a4defe154c5bea524b5bdc217a2c9c06eac2062f512d958f6a7c79322022d03af9f38c
-
Filesize
106KB
MD52cc191d244cfea9109e4e1a3b910c9ab
SHA106e609468640b3aeba12ff492932db61636c9d04
SHA256ede35097cc696287c5b0eb4d642d0e59d337645c77fb7de818a52957706b8e05
SHA512aa12021b789784bbeae1e2e0d232fe6448c574eb9355216cef248a09d3741573f20fe5f40de49e92debd4055b8c68875de7ed1c2274bf4f9724743e32e5d6cd7
-
Filesize
106KB
MD5546dfc23f8ea5f583ac841e83a4362b7
SHA13cbdbb116b5e9bed086debf81d5f249dedd24d04
SHA2568443618bdf791903f7eabf2c939783f366c92f4c38f982af11d82f02f9d2964b
SHA5122e51e3a96029154d986846662bfb33cca94e22c88a586d21d2153fa3b9f35d16dea0d9705c3d0e9ff93849c0452425a6e824f0c3cc7bf573fa33737c9ed38946
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd